syzbot


uvm_fault: ADDR: movb $0xaa,%clddb> ddb> set $lines = 0ddb> set $maxwidth = 0ddb> show panickernel page faul

Status: closed as dup on 2019/09/26 08:38
Reported-by: syzbot+cc3a6394fd2e573a4417@syzkaller.appspotmail.com
First crash: 1884d, last: 1884d
Duplicate of
Title Repro Cause bisect Fix bisect Count Last Reported
panic: attempt to execute user address 0x1 in supervisor mode 1 1892d 1892d

Sample crash report:
uvm_fault(0xffffffff8251f028, 0xfffffd802e36bed8, 0, 4) -> e
kernel: page fault trap, code=0
Stopped at      0xfffffd802e36bed8:     movb    $0xaa,%cl
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
kernel page fault
uvm_fault(0xffffffff8251f028, 0xfffffd802e36bed8, 0, 4) -> e
fffffd802e36bed8(b,ffff80001697e158,83,ffff80001697e1f8,0,b) at 0xfffffd802e36bed8
end trace frame: 0xffff80001697e250, count: 0
ddb> trace
fffffd802e36bed8(b,ffff80001697e158,83,ffff80001697e1f8,0,b) at 0xfffffd802e36bed8
rt_match(fffffd8039414da0,0,1,0) at rt_match+0xbe rt_clone sys/net/route.c:266 [inline]
rt_match(fffffd8039414da0,0,1,0) at rt_match+0xbe sys/net/route.c:242
in_pcbselsrc(ffff80001697e2d0,fffffd802ad93820,fffffd8039414d20) at in_pcbselsrc+0x219 sys/netinet/in_pcb.c:934
in_pcbconnect(fffffd8039414d20,fffffd802ad93800) at in_pcbconnect+0x107 sys/netinet/in_pcb.c:492
udp_usrreq(fffffd802b68b600,4,0,fffffd802ad93800,0,ffff800014934290) at udp_usrreq+0x560
sys_connect(ffff800014934290,ffff80001697e458,ffff80001697e4a0) at sys_connect+0x3df sys/kern/uipc_syscalls.c:388
syscall(ffff80001697e520) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555
Xsyscall(6,0,fffffffffffffed2,0,3,9c98d923010) at Xsyscall+0x128
end of kernel
end trace frame: 0x9cc342548e0, count: -8
ddb> show registers
rdi               0xffff800000a80800
rsi                              0xb
rbp               0xffff80001697e140
rbx               0xfffffd8038e8a2a8
rdx               0xfffffd8038e8a2a8
rcx               0xffff800014936000
rax               0xffff800014936000
r8                             0x100
r9                               0x7
r10               0x5e9354f3a0f52174
r11               0xfffffd802e36bed8
r12               0xfffffd8038e8a2a8
r13               0xffff80001697e158
r14               0xffff80001697e1f8
r15               0xffff8000000252b0
rip               0xfffffd802e36bed8
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80001697e048
ss                              0x10
0xfffffd802e36bed8:     movb    $0xaa,%cl
ddb> show proc
PROC (syz-executor.1) pid=346344 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=83, usrpri=83, nice=20
    forw=0xffffffffffffffff, list=0xffff800014935650,0xffffffff8255bd20
    process=0xffff8000ffff70f0 user=0xffff800016979000, vmspace=0xfffffd803f013dd0
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 72786  147434  55024      0  2           0                syz-executor.1
*72786  346344  55024      0  7   0x4000000                syz-executor.1
 63148  111937  50018      0  2         0x2                syz-executor.0
 55024  105515  50018      0  3        0x82  nanosleep     syz-executor.1
 30574  204551      1      0  3    0x100083  ttyin         getty
 25299  448498      0      0  3     0x14200  acct          acct
 93610  471559      0      0  3     0x14200  bored         sosplice
 50018  486284  28228      0  3        0x82  thrsleep      syz-fuzzer
 50018  226569  28228      0  3   0x4000082  thrsleep      syz-fuzzer
 50018  302330  28228      0  3   0x4000082  thrsleep      syz-fuzzer
 50018  285053  28228      0  3   0x4000082  thrsleep      syz-fuzzer
 50018  430493  28228      0  3   0x4000082  thrsleep      syz-fuzzer
 50018  463374  28228      0  3   0x4000082  thrsleep      syz-fuzzer
 50018   61158  28228      0  3   0x4000082  thrsleep      syz-fuzzer
 50018  150356  28228      0  3   0x4000082  kqread        syz-fuzzer
 28228  102311  54237      0  3    0x10008a  pause         ksh
 54237  181249  64567      0  3        0x92  select        sshd
 64567  237845      1      0  3        0x80  select        sshd
  1636  200532   8710     73  3    0x100090  kqread        syslogd
  8710  299876      1      0  3    0x100082  netio         syslogd
   627  335515      1     77  3    0x100090  poll          dhclient
 63233   73591      1      0  3        0x80  poll          dhclient
 89566  315287      0      0  2     0x14200                zerothread
 80485   54809      0      0  3     0x14200  aiodoned      aiodoned
 10192  369105      0      0  3     0x14200  syncer        update
  2434   23761      0      0  3     0x14200  cleaner       cleaner
 74138  342453      0      0  3     0x14200  reaper        reaper
 77219  289339      0      0  3     0x14200  pgdaemon      pagedaemon
 85367  138902      0      0  3     0x14200  bored         crynlk
 66936  158644      0      0  3     0x14200  bored         crypto
 61478  188316      0      0  3  0x40014200  acpi0         acpi0
 60195  392732      0      0  3     0x14200  bored         softnet
 38416  378055      0      0  3     0x14200  bored         systqmp
 47900  512615      0      0  3     0x14200  bored         systq
 44367  295998      0      0  3  0x40014200  bored         softclock
 62273  228110      0      0  3  0x40014200                idle0
 42169  473931      0      0  3     0x14200  bored         smr
     1   78099      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim Kern Lim
         devbuf  9595   7025K    7034K  78643K     16141        0        0
            pcb    13      8K       8K  78643K       923        0        0
         rtable   112     12K      14K  78643K      2559        0        0
         ifaddr    93     20K      21K  78643K       710        0        0
       counters    19     16K      16K  78643K        19        0        0
       ioctlops     0      0K       2K  78643K       246        0        0
            iov     0      0K      32K  78643K      1335        0        0
          mount     1      1K       1K  78643K         1        0        0
         vnodes  1204     76K      77K  78643K      4055        0        0
      UFS quota     1     32K      32K  78643K         1        0        0
      UFS mount     5     36K      36K  78643K         5        0        0
            shm     2      1K       9K  78643K        54        0        0
         VM map     2      0K       0K  78643K        22        0        0
            sem    12      0K       1K  78643K       528        0        0
        dirhash    12      2K       2K  78643K        12        0        0
           ACPI  1793    195K     288K  78643K     12645        0        0
      file desc     5     13K      25K  78643K      4663        0        0
          sigio     0      0K       0K  78643K       644        0        0
           proc    50     38K      63K  78643K      1757        0        0
        subproc    32      2K       2K  78643K       425        0        0
    NFS srvsock     1      0K       0K  78643K         1        0        0
     NFS daemon     1     16K      16K  78643K         1        0        0
    ip_moptions     0      0K       0K  78643K       243        0        0
       in_multi    25      1K       2K  78643K       491        0        0
    ether_multi     1      0K       0K  78643K        23        0        0
            mrt     0      0K       0K  78643K        28        0        0
    ISOFS mount     1     32K      32K  78643K         1        0        0
  MSDOSFS mount     1     16K      16K  78643K         1        0        0
           ttys   102    450K     450K  78643K       102        0        0
           exec     0      0K       1K  78643K       946        0        0
        pagedep     1      8K       8K  78643K         1        0        0
       inodedep     1     32K      32K  78643K         1        0        0
         newblk     1      0K       0K  78643K         1        0        0
        VM swap     7     26K      26K  78643K         7        0        0
       UVM amap   120     22K      32K  78643K     12555        0        0
       UVM aobj   130      4K       4K  78643K       138        0        0
        memdesc     1      4K       4K  78643K         1        0        0
    crypto data     1      1K       1K  78643K         1        0        0
    ip6_options     0      0K       1K  78643K       839        0        0
            NDP    23      0K       1K  78643K       234        0        0
           temp   247   3537K    4179K  78643K    136670        0        0
         kqueue     0      0K       0K  78643K        22        0        0
      SYN cache     2     16K      16K  78643K         2        0        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
arp         64       93    0       88     1     0     1     1     0     8    0
rtpcb       80      363    0      361     1     0     1     1     0     8    0
rtentry    112      480    0      442     2     0     2     2     0     8    0
unpcb      120     2046    0     2034     1     0     1     1     0     8    0
syncache   264       19    0       19     7     6     1     1     0     8    1
tcpqe       32     7691    0     7691     4     4     0     2     0     8    0
tcpcb      544     2513    0     2509    17    15     2     3     0     8    1
ipq         40       21    0       21     8     8     0     1     0     8    0
ipqe        40       48    0       48     8     8     0     1     0     8    0
inpcb      280     5329    0     5320    18    16     2     3     0     8    1
rttmr       72        9    0        8     2     1     1     1     0     8    0
nd6         48       67    0       65     3     2     1     1     0     8    0
pkpcb       40       16    0       16     5     5     0     1     0     8    0
swfcl       56        1    0        0     1     0     1     1     0     8    0
ppxss      1128      75    0       75    14    13     1     1     0     8    1
art_heap8  4096       3    0        2     3     2     1     3     0     8    0
art_heap4  256     2024    0     1815    31    15    16    17     0     8    0
art_table   32     2027    0     1817     3     0     3     3     0     8    0
art_node    16      472    0      438     1     0     1     1     0     8    0
sysvmsgpl   40       24    0       10     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112      526    0      516     1     0     1     1     0     8    0
shmpl      112      136    0        8     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino1pl    128    10725    0     9327    46     0    46    46     0     8    0
ffsino     240    10725    0     9327    83     0    83    83     0     8    0
nchpl      144    18238    0    16620    61     0    61    61     0     8    0
uvmvnodes   72     6596    0        0   120     0   120   120     0     8    0
vnodes     208     6596    0        0   348     0   348   348     0     8    0
namei      1024   63386    0    63386     5     4     1     1     0     8    1
vmpool     520       20    0       20    10     9     1     1     0     8    1
scsiplug    64        4    0        4     3     3     0     1     0     8    0
scxspl     192    64877    0    64877    30    29     1     7     0     8    1
plimitpl   152      354    0      347     1     0     1     1     0     8    0
sigapl     432     4768    0     4755     2     0     2     2     0     8    0
futexpl     56   120329    0   120329     4     3     1     1     0     8    1
knotepl    112     1060    0     1041     3     2     1     2     0     8    0
kqueuepl   104     1170    0     1168     1     0     1     1     0     8    0
pipepl     112     2728    0     2709    10     8     2     2     0     8    1
fdescpl    424     4769    0     4755     2     0     2     2     0     8    0
filepl     120    41653    0    41555    15    11     4     5     0     8    0
lockfpl    104     1865    0     1864     1     0     1     1     0     8    0
lockfspl    48      637    0      636     1     0     1     1     0     8    0
sessionpl  112       43    0       33     1     0     1     1     0     8    0
pgrppl      48       77    0       67     1     0     1     1     0     8    0
ucredpl     96     5075    0     5066     1     0     1     1     0     8    0
zombiepl   144     4756    0     4756     4     3     1     1     0     8    1
processpl  864     4786    0     4756     4     0     4     4     0     8    0
procpl     632    10623    0    10585     6     2     4     5     0     8    0
sosppl     128       58    0       58    14    14     0     1     0     8    0
sockpl     384     7802    0     7779    20    16     4     6     0     8    0
mcl64k     65536   2045    0     2045   168   167     1    33     0     8    1
mcl16k     16384     38    0       38    16    15     1     1     0     8    1
mcl12k     12288    128    0      128    11    10     1     1     0     8    1
mcl9k      9216      65    0       65    13    12     1     1     0     8    1
mcl8k      8192     214    0      214     6     5     1     1     0     8    1
mcl4k      4096     567    0      567     6     5     1     1     0     8    1
mcl2k2     2112      46    0       46    17    17     0     1     0     8    0
mcl2k      2048   60185    0    60144    37    30     7    24     0     8    1
mtagpl      80      279    0      279     6     6     0     4     0     8    0
mbufpl     256   132645    0   132566   119   110     9    45     0     8    0
bufpl      256    26037    0    18735   457     0   457   457     0     8    0
anonpl      16   590335    0   575779   174    96    78    88     0    62   13
amapchunkpl 152   25576    0    25472    72    54    18    18     0   158   13
amappl16   192    29739    0    28861   236   189    47    64     0     8    2
amappl15   184     1520    0     1519     5     4     1     1     0     8    0
amappl14   176      704    0      700     1     0     1     1     0     8    0
amappl13   168      834    0      832     4     3     1     1     0     8    0
amappl12   160      718    0      716     1     0     1     1     0     8    0
amappl11   152      139    0      128     1     0     1     1     0     8    0
amappl10   144      252    0      249     1     0     1     1     0     8    0
amappl9    136     2129    0     2122     1     0     1     1     0     8    0
amappl8    128     1669    0     1623     2     0     2     2     0     8    0
amappl7    120      364    0      355     1     0     1     1     0     8    0
amappl6    112      105    0       94     1     0     1     1     0     8    0
amappl5    104     1036    0     1026     1     0     1     1     0     8    0
amappl4     96     4582    0     4548     1     0     1     1     0     8    0
amappl3     88      836    0      831     1     0     1     1     0     8    0
amappl2     80    37441    0    37372     3     1     2     3     0     8    0
amappl1     72    96617    0    96206    26    17     9    20     0     8    0
amappl      80    11267    0    11232     1     0     1     1     0    84    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       17    0       17     1     1     0     1     0     8    0
aobjpl      64      137    0        8     3     0     3     3     0     8    0
uaddrrnd    24     4789    0     4755     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     4789    0     4755     1     0     1     1     0     8    0
vmmpekpl   168    32991    0    32964     2     0     2     2     0     8    0
vmmpepl    168   587454    0   585496   317   198   119   124     0   357   28
vmsppl     272     4768    0     4755     5     4     1     2     0     8    0
pdppl      4096    9584    0     9550     7     2     5     6     0     8    0
pvpl        32  1539939    0  1522269   465   195   270   290     0   265  112
pmappl     200     4788    0     4775     1     0     1     1     0     8    0
extentpl    40       41    0       26     1     0     1     1     0     8    0
phpool     112      965    0      376    19     0    19    19     0     8    0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/25 16:35 openbsd 9bfe40da2ae4 a3355dba .config console log report ci-openbsd-main
* Struck through repros no longer work on HEAD.